{"metadata": {"vulnerability": "CVE-2026-84314", "count": 14, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-09-01T16:17:43.079Z", "date_only": false, "value": "2026-09-01T16:17:43.079Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-84314", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-12T20:47:51.561Z", "date_only": false, "value": "2026-10-12T20:47:51.561Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-84314", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-12T20:47:51.561Z", "date_only": false, "value": "2026-10-12T20:47:51.561Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-84314", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-12T20:53:44.079Z", "date_only": false, "value": "2026-10-12T20:53:44.079263Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117429922892588632", "record": "CVE-2026-84314", "field": "creation_timestamp", "uuid": "bf4dca6f-17b3-4ed9-8b2a-82b99d2de61e", "content": "CVE-2026-84314 Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the POST /api/users/:id user-management endpoint permits an authenticated user to change another user's password without passing RequireSecureSession, even though the self-service password-change path requires that step-up. An attacker with an authenticated account can change the initial administrator's password, invalidate existing administrator tokens, and then authenticate as the administrator. This issue is fixed in version 2.4.1.\nhttps://www.cve.org/CVERecord?id=CVE-2026-84314https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-2gc7-j998-5xx6https://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1#0xJacky #nginx-ui#CVE_2026_84314#bot", "url": "https://infosec.exchange/users/cve/statuses/117429922892588632"}, {"timestamp": "2026-10-12T21:17:21Z", "date_only": false, "value": "2026-10-12T21:17:21Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-2GC7-J998-5XX6", "record": "GHSA-2GC7-J998-5XX6", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-12T21:17:21.753Z", "date_only": false, "value": "2026-10-12T21:17:21.753", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-84314", "record": "FKIE_CVE-2026-84314", "field": "published"}, {"timestamp": "2026-10-13T17:31:07.190Z", "date_only": false, "value": "2026-10-13T17:31:07.190328Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-84314", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-13T17:31:07.190Z", "date_only": false, "value": "2026-10-13T17:31:07.190328Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-84314", "record": "FKIE_CVE-2026-84314", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-13T17:32:02.947Z", "date_only": false, "value": "2026-10-13T17:32:02.947Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-84314", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-13T17:32:02.947Z", "date_only": false, "value": "2026-10-13T17:32:02.947Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-84314", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-13T18:17:25.927Z", "date_only": false, "value": "2026-10-13T18:17:25.927", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-84314", "record": "FKIE_CVE-2026-84314", "field": "lastModified"}, {"timestamp": "2026-10-14T03:20:04.488Z", "date_only": false, "value": "2026-10-14T03:20:04.488666Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxslo5e7ac2n", "record": "CVE-2026-84314", "field": "creation_timestamp", "uuid": "3c82331c-0926-4a15-a74c-8fb567f6cc8f", "content": "CVE-2026-84314 - nginx-ui\nThe nginx-ui web interface (versions before 2.4.1) lets anyone who is already logged in change another user's password without extra verification. This means an attacker could\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#nginxui #0xjacky #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxslo5e7ac2n"}, {"timestamp": "2026-10-15T20:11:45Z", "date_only": false, "value": "2026-10-15T20:11:45Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-2GC7-J998-5XX6", "record": "GHSA-2GC7-J998-5XX6", "field": "published"}, {"timestamp": "2026-10-15T20:11:45Z", "date_only": false, "value": "2026-10-15T20:11:45Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-2GC7-J998-5XX6", "record": "GHSA-2GC7-J998-5XX6", "field": "modified"}]}